View a markdown version of this page

Amazon ECS 服务扩展执行块示例策略 - Amazon 应用程序恢复控制器（ARC）
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

Amazon ECS 服务扩展执行块示例策略

（可选）等待目标组运行状况的权限

在您的 Amazon ECS 服务扩展执行区块上启用该waitELBTargetGroupHealthy选项后，添加以下权限。有关此选项的更多信息，请参阅 Amazon ECS 服务扩展执行块。

  • ecs:ListTasks— 列出服务的运行任务，以便区域交换机知道要检查哪些目标。

  • ecs:DescribeTasks— 获取每项任务的网络详细信息（任务 ENI IP 地址或容器实例和主机端口），以识别其目标组条目。

  • elasticloadbalancing:DescribeTargetHealth— 读取相关目标组中服务目标的运行状况。

  • ecs:DescribeContainerInstances— 将任务的容器实例解析为其 EC2 实例 ID 以进行目标匹配。仅当服务运行使用bridge或host网络模式的任务时才需要。

如果禁用该waitELBTargetGroupHealthy选项，则可以省略这些权限。

以下是在 Amazon ECS 服务扩展的区域切换计划中添加执行区块时要附加的 JSON 策略示例：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeServices",
        "ecs:UpdateService"
      ],
      "Resource": [
        "arn:aws:ecs:us-east-1:111122223333:service/app-cluster-primary/app-service",
        "arn:aws:ecs:us-west-2:111122223333:service/app-cluster-secondary/app-service"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeClusters"
      ],
      "Resource": [
        "arn:aws:ecs:us-east-1:111122223333:cluster/app-cluster-primary",
        "arn:aws:ecs:us-west-2:111122223333:cluster/app-cluster-secondary"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:ListServices"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:RegisterScalableTarget"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RequiredOnlyWhenWaitELBTargetGroupHealthyEnabled",
      "Effect": "Allow",
      "Action": [
        "ecs:ListTasks",
        "elasticloadbalancing:DescribeTargetHealth"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DescribeTasksWhenWaitELBTargetGroupHealthyEnabled",
      "Effect": "Allow",
      "Action": [
         "ecs:DescribeTasks"
      ],
      "Resource": [
         "arn:aws:ecs:us-east-1:111122223333:task/app-cluster-primary/*",
         "arn:aws:ecs:us-west-2:111122223333:task/app-cluster-secondary/*"
      ]
    },
    {
      "Sid": "RequiredOnlyForBridgeOrHostNetworkModeTasks",
      "Effect": "Allow",
      "Action": [
         "ecs:DescribeContainerInstances"
      ],
      "Resource": [
         "arn:aws:ecs:us-east-1:111122223333:container-instance/app-cluster-primary/*",
         "arn:aws:ecs:us-west-2:111122223333:container-instance/app-cluster-secondary/*"
      ]
    }
  ]
}